1. Field of the Invention
The present invention relates to a method for detecting distributed denial of service (DDOS) attacks, and in particular, to an analyzing method based on grey theory for detecting DDOS attacks.
2. Description of the Related Art
Currently, malicious network activities are detected through comparison of ongoing traffic data to previously obtained traffic data within certain periods of time, such as network flow in one week. For example, to determine an occurrence of network intrusion at mid-night on a Wednesday, traffic data from the previous Wednesday is compared, and if any malicious network activity is determined, a defense procedure is activated. Considerable data storage is consumed in achieving the determination, and computation resources are taxed when searching and comparing stored traffic data. Currently, to overcome bottlenecks in data calculation speed, costly hardware is utilized along with various data mining technologies and applications.
In data mining, messages hidden in various data are analyzed and categorized. Various methodologies, each having different advantages and applicability are utilized in data mining. Methods are divided into those based on traditional statistical theories, such as identifying valuable messages in data or distribution of different data types, and those having close relationships with traditional artificial intelligence domains, such as grouping, categorizing, and similarity searching. Many of the methods therein are highly developed with significant results. In addition to traditional quality determination of standard data testing, data mining has currently been utilized with database technologies.
Intrusion detection systems are therefore applied with theories of data mining to quantify, categorize, group, and label network traffic data in various mathematical methodologies. First, network traffic data is converted to sequences. Thereafter, corresponding characteristic patterns are built through algorithms such as sequential pattern mining, and then compared with previously built characteristic patterns stored in an existing knowledge database to determine whether a similarity threshold is exceeded. The characteristic patterns are assessed as identical when the similarity threshold is exceeded, and if the new characteristic patterns are supersets of the old ones, the knowledge database is updated accordingly. If the characteristic patterns do not previously exist in the knowledge database, they are analyzed by an assessment module, and the result is fed back to the knowledge database as new rules for further intrusion detection and system management.
Intrusion detection is currently accomplished through statistics and data mining, and relies on hardware to overcome computation speed bottlenecks. While characteristic patterns are sought, network traffic data is extended infinitely, whereby loading may be too high for the system to complete the detection, and storage capacity may be insufficient to store network traffic data. Current high volumes of traffic and rapid migration of malicious activity characteristics combine to easily thwart conventional statistical and data mining technology. When DDOS attacks occur, not only do system administrators suffer, but entire enterprises may be seriously affected.